netdev - Re: [PATCH net 1/1] tipc: fix bug in broadcast retransmit code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20150112.160226.1565196942326918189.davem@davemloft.net>
Date:	Mon, 12 Jan 2015 16:02:26 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	jon.maloy@...csson.com
Cc:	netdev@...r.kernel.org, paul.gortmaker@...driver.com,
	erik.hugne@...csson.com, ying.xue@...driver.com, maloy@...jonn.com,
	tipc-discussion@...ts.sourceforge.net
Subject: Re: [PATCH net 1/1] tipc: fix bug in broadcast retransmit code

From: Jon Maloy <jon.maloy@...csson.com>
Date: Thu,  8 Jan 2015 12:27:27 -0500

> In commit 58dc55f25631178ee74cd27185956a8f7dcb3e32 ("tipc: use generic
> SKB list APIs to manage link transmission queue") we replace all list
> traversal loops with the macros skb_queue_walk() or
> skb_queue_walk_safe(). While the previous loops were based on the
> assumption that the list was NULL-terminated, the standard macros
> stop when the iterator reaches the list head, which is non-NULL.
> 
> In the function bclink_retransmit_pkt() this macro replacement has
> lead to a bug. When we receive a BCAST STATE_MSG we unconditionally
> call the function bclink_retransmit_pkt(), whether there really is
> anything to retransmit or not, assuming that the sequence number
> comparisons will lead to the correct behavior. However, if the
> transmission queue is empty, or if there are no eligible buffers in
> the transmission queue, we will by mistake pass the list head pointer
> to the function tipc_link_retransmit(). Since the list head is not a
> valid sk_buff, this leads to a crash.
> 
> In this commit we fix this by only calling tipc_link_retransmit()
> if we actually found eligible buffers in the transmission queue.
> 
> Reviewed-by: Ying Xue <ying.xue@...driver.com>
> Signed-off-by: Jon Maloy <jon.maloy@...csson.com>

Applied, thanks Jon.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html